One of the dev dependencies of cloud-functions is firebase-tools
, which has a vulnerable version of dot-prop
as a sub-dependency. According to firebase/firebase-tools#2503, this will be fixed soon, so we should update firebase-tools
as soon as it is fixed. (Follow-up from #357)